F-MACRO - Scanner and disinfector for MS Word document macro viruses
Version 1.11, 2.23 (3rd of June, 1996)
Copyright (c) 1996 Data Fellows Ltd

OVERVIEW

F-MACRO is a DOS program which searches Word 6.x and 7.x document
files for known Word macro viruses and disinfects them by disabling
and overwriting the viral macros. F-MACRO is able to parse the complex
OLE2 file structure of Word document files making it very fast and
accurate.

TECHNOLOGY

This scanning and disinfection technology was developed by Data
Fellows Ltd for the commercial F-PROT Professional package. F-PROT
Professional for Windows, Windows 95, Windows NT and OS/2 as well as
the realtime Windows VxD scanners have these macro scanning features
built in to their normal scanners.

If you are running a VxD-based background protection from the F-PROT
Professional suite, you will be notified on infected document files as
soon as you try to open or copy them or when you are receiving such a
document as an e-mail attachment or downloading it from www.
Disinfection can also be done in realtime. A VxD-based solution
provides significantly better protection than antivirus systems
relying on the Word macro language.

For more information on the F-PROT Professional suite, see the web
site of Data Fellows at http://www.datafellows.com/ or the web site of
the US publisher, Command Software Systems at
http://www.commandcom.com/.

USAGE

Give scan path or drive as the first parameter.

Options:

        /DISINF   disinfects infected document
        /AUTO     automatic disinfection, no prompting
        /ALL      scans files with any extension
        /REPORT=  Send the output to a file
        /APPEND   Used with /REPORT - append to existing report
        /NOSUB    do not recurse sub-directories
        /LIST     list all scanned filenames
        /COMPRESS removes unreferenced data from file
        /BACKUP   makes a copy of the file before disinfecting it


Examples:

     F-MACRO C:
     F-MACRO C:\DOCS /ALL /DISINF /AUTO
     F-MACRO Z:\USER\INFECTED.DOC /COMPRESS

Notes:

In order to be able to scan all document files, Word should be closed
down before running F-MACRO: otherwise it will keep NORMAL.DOT and
possibly other files locked. F-MACRO will give a warning message on
such files.

If you have document files with non-standard extensions (something
else than DOC or DOT), use the /ALL parameter to check all files.

If an another virus scanner still thinks that a document file is
infected after being cleaned by F-MACRO, use the /COMPRESS option to
remove unused slack areas from a DOC file. You can also use this
option if a document has already been disinfected manually via
Tools/Macro, but you receive a false positive from some scanner.

F-MACRO will turn infected documents back to normal document type,
removing the template attribute added by the viruses.

SUPPORT

For general info on macro viruses, see the macro section at
http://www.datafellows.com/. For technical support, contact
F-MACRO-Support@datafellows.com. To send samples of new or
suspected viruses, see NEW_VIR.DOC.

UPDATES

Updates, when available, can be downloaded from the Data Fellows WWW
and ftp sites.

KNOWN MACRO VIRUSES

F-MACRO does not search for new and unknown macro viruses.
List of currently detected and disinfected macro viruses:

WordMacro/Atom
WordMacro/Boom
WordMacro/Colors
WordMacro/Concept
WordMacro/Concept.Fr
WordMacro/DMV
WordMacro/Friendly
WordMacro/Hot
WordMacro/Imposter
WordMacro/NOP
WordMacro/Nuclear
WordMacro/Nuclear.B
WordMacro/Pheeew
WordMacro/Sex
WordMacro/Wazzu
WordMacro/Xenixos

and the following macro trojan:

WordMacro/FormatC

Total: 17 viruses or trojans

The Data Fellows web site has up-to-date descriptions on the
operation and effects of these macro viruses.

LEGAL

F-MACRO is protected by international copyright laws. F-MACRO is
copyright (c) 1996 Data Fellows Ltd, and it is not in public domain or
freeware, but you are free to use and share this software with no
charges in non-commercial private use. Use of this software in other
environments is not allowed in Europe, Asia and Africa without a
license to F-PROT Professional or a current license from Frisk
Software International. Please redistribute F-MACRO only with this
documentation. You are not allowed to resell this software for your
own profit (normal copying costs excluded) or claim to hold rights to
this software. Although you may have the right to use F-MACRO, it will
remain the exclusive property of Data Fellows. Data Fellows does not
warrant that the software is error free and we will not cover any
costs created by function or malfunction of this program. Data Fellows
also disclaims liability for possible consequential damages. If you
cannot agree to these restrictions, you should not use F-MACRO.

Copyright (c) 1996 Data Fellows Ltd, Finland
